Proofpoint recently reported that TA4922, a Chinese-speaking, financially motivated cybercrime group, has expanded from East Asia to target organizations in the UK, Germany, Italy, South Africa, and parts of Southeast Asia and Japan. Proofpoint says TA4922 now runs more unique campaigns than any other cybercrime actor it tracks, using localized phishing lures themed around HR, payroll, taxes, invoices, and government notices, then shifting victims to WhatsApp, LINE, or Microsoft Teams to bypass email defenses. The group’s rapidly evolving toolkit includes Atlas RAT (for recon, file theft, keylogging, screenshots, audio/webcam recording, and system control), ValleyRAT/Winos 4.0, and new loaders RomulusLoader and SilentRunLoader, which use DLL sideloading, process hollowing, and Chrome data theft. RomulusLoader also deploys remote tools like AnyDesk and SyncFuture. Code artifacts suggest TA4922 may be using large language models (LLMs) to speed development. While primarily profit-driven (fraud, data theft, access resale), the malware’s surveillance capabilities could be used by or sold to espionage actors.